Skip to content
Log inStart free trial

GHSA-vm8q-m57g-pff3 BIT-django-2024-27351 CVE-2024-27351 PYSEC-2024-47

Regular expression denial-of-service in Django

Medium PyPI
Severity
5.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
1.85%
Chance of exploitation in the next 30 days. Higher than 79.17% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1333 Inefficient Regular Expression Complexity
Fix
3.2.25
Upgrade django to this version or later

Description

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Affected versions

PyPI

PackageVulnerableFixed in
django
>= 3.2, < 3.2.25
3.2.25
django
>= 4.2, < 4.2.11
4.2.11
django
>= 5.0, < 5.0.3
5.0.3
django
>= 3.2, < 3.2.25
>= 4.2, < 4.2.11
>= 5.0, < 5.0.3
3.2.25
4.2.11
5.0.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

django PyPI → 3.2.25

pip
pip install --upgrade "django>=3.2.25"
poetry
poetry add "django>=3.2.25"
uv
uv add "django>=3.2.25"

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it
  • Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
  • System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
  • Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
  • Implementation: Limit the length of the input that the regular expression will process.

References

Advisories

Write-ups

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-q238-5cxm-5c9h
Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
Medium Also affects django
GHSA-wvqv-fj8w-qmhm
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
High Also affects django
GHSA-8qcx-xf44-272x
Django: DomainNameValidator permits newline characters that may enable HTTP header injection
Medium Also affects django
GHSA-crhf-3pfg-w68w
Django: GDALRaster may over-read heap memory when constructed from bytes
Medium Also affects django
GHSA-3h9f-r86x-qvjx
Django: cache middleware may expose private responses when unrelated request cookies are present
Medium Also affects django
GHSA-8cjm-8mp7-r2xf
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Medium Also affects django
GHSA-mm6v-q8q9-pgcf
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low Also affects django
GHSA-h7pc-vwp9-298g
Django: signed cookies are vulnerable to salt namespace collisions
Medium Also affects django
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor